feat: arch-aware downloads in create-build and fetch-busybox target

- Update setupKernel/setupFC to use arch-prefixed URLs with legacy fallback
- Add errNotFound sentinel for 404 handling in download helper
- Use atomic temp-file writes to avoid partial downloads
- Add fetch-busybox Makefile target to swap busybox binary for ARM64 builds

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 2 people

packages/orchestrator/Makefile

@@ -28,14 +28,14 @@ build:
 	@docker build --platform $(BUILD_PLATFORM) --output=bin --build-arg COMMIT_SHA="$(COMMIT_SHA)" -f ./Dockerfile ..
 
 .PHONY: build-local
-build-local:
+build-local: fetch-busybox
 	# Allow for passing commit sha directly for docker builds
 	$(eval COMMIT_SHA ?= $(shell git rev-parse --short HEAD))
 	CGO_ENABLED=1 GOOS=linux GOARCH=$(BUILD_ARCH) go build -o bin/orchestrator -ldflags "-X=main.commitSHA=$(COMMIT_SHA)" .
 	CGO_ENABLED=1 GOOS=linux GOARCH=$(BUILD_ARCH) go build -o bin/clean-nfs-cache -ldflags "-X=main.commitSHA=$(COMMIT_SHA)" ./cmd/clean-nfs-cache
 
 .PHONY: build-debug
-build-debug:
+build-debug: fetch-busybox
 	CGO_ENABLED=1 GOOS=linux GOARCH=$(BUILD_ARCH) go build -race -gcflags=all="-N -l" -o bin/orchestrator .
 
 .PHONY: run-debug
@@ -132,6 +132,34 @@ build-template:
 	-kernel $(KERNEL_VERSION) \
 	-firecracker $(FIRECRACKER_VERSION)
 
+.PHONY: fetch-busybox
+fetch-busybox:
+	@ARCH=$$(go env GOARCH); \
+	BUSYBOX_TARGET=./pkg/template/build/core/systeminit/busybox_1.36.1-2; \
+	if [ "$$ARCH" != "arm64" ]; then \
+		echo "✓ Using bundled amd64 busybox"; \
+	elif file "$$BUSYBOX_TARGET" 2>/dev/null | grep -q 'aarch64\|ARM aarch64'; then \
+		echo "✓ Busybox is already arm64"; \
+	elif command -v busybox >/dev/null 2>&1 && file "$$(command -v busybox)" 2>/dev/null | grep -q 'aarch64\|ARM aarch64' && file "$$(command -v busybox)" 2>/dev/null | grep -q 'statically linked'; then \
+		cp "$$(command -v busybox)" "$$BUSYBOX_TARGET" && \
+		echo "✓ Copied host busybox (arm64, static) to embedded path"; \
+	elif command -v apt-get >/dev/null 2>&1 && command -v dpkg-deb >/dev/null 2>&1; then \
+		echo "Fetching arm64 busybox via apt..."; \
+		TMPDIR=$$(mktemp -d); \
+		apt-get download busybox-static 2>/dev/null && \
+			dpkg-deb -x busybox-static_*.deb "$$TMPDIR" && \
+			cp "$$TMPDIR/bin/busybox" "$$BUSYBOX_TARGET" && \
+			rm -rf "$$TMPDIR" busybox-static_*.deb && \
+			echo "✓ Replaced embedded busybox with arm64 binary (from busybox-static package)" || \
+			{ rm -rf "$$TMPDIR" busybox-static_*.deb; echo "⚠ apt-get download failed"; exit 1; }; \
+	else \
+		echo "⚠ ARM64 busybox required but no method available to fetch it."; \
+		echo "  Options:"; \
+		echo "    1. Install busybox-static: apt install busybox-static, then re-run"; \
+		echo "    2. Manually place an arm64 busybox binary at: $$BUSYBOX_TARGET"; \
+		exit 1; \
+	fi
+
 .PHONY: migrate
 migrate:
 	./scripts/upload-envs.sh /mnt/disks/fc-envs/v1 $(TEMPLATE_BUCKET_NAME)

packages/orchestrator/cmd/create-build/main.go

@@ -414,71 +414,141 @@ func printLocalFileSizes(basePath, buildID string) {
 }
 
 func setupKernel(ctx context.Context, dir, version string) error {
-	dstPath := filepath.Join(dir, version, "vmlinux.bin")
+	arch := utils.TargetArch()
+	dstPath := filepath.Join(dir, version, arch, "vmlinux.bin")
+
 	if err := os.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
 		return fmt.Errorf("mkdir kernel dir: %w", err)
 	}
 
 	if _, err := os.Stat(dstPath); err == nil {
-		fmt.Printf("✓ Kernel %s exists\n", version)
+		fmt.Printf("✓ Kernel %s (%s) exists\n", version, arch)
 
 		return nil
 	}
 
-	kernelURL, _ := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/kernels/", version, "vmlinux.bin")
-	fmt.Printf("⬇ Downloading kernel %s...\n", version)
+	// Try arch-specific URL first: {version}/{arch}/vmlinux.bin
+	archURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/kernels/", version, arch, "vmlinux.bin")
+	if err != nil {
+		return fmt.Errorf("invalid kernel URL: %w", err)
+	}
+
+	fmt.Printf("⬇ Downloading kernel %s (%s)...\n", version, arch)
+
+	if err := download(ctx, archURL, dstPath, 0o644); err == nil {
+		return nil
+	} else if !errors.Is(err, errNotFound) {
+		return fmt.Errorf("failed to download kernel: %w", err)
+	}
+
+	// Legacy URLs are x86_64-only; only fall back for amd64.
+	if arch != "amd64" {
+		return fmt.Errorf("kernel %s not found for %s (no legacy fallback for non-amd64)", version, arch)
+	}
+
+	legacyURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/kernels/", version, "vmlinux.bin")
+	if err != nil {
+		return fmt.Errorf("invalid kernel legacy URL: %w", err)
+	}
+
+	fmt.Printf("  %s path not found, trying legacy URL...\n", arch)
 
-	return download(ctx, kernelURL, dstPath, 0o644)
+	return download(ctx, legacyURL, dstPath, 0o644)
 }
 
 func setupFC(ctx context.Context, dir, version string) error {
-	dstPath := filepath.Join(dir, version, "firecracker")
+	arch := utils.TargetArch()
+	dstPath := filepath.Join(dir, version, arch, "firecracker")
+
 	if err := os.MkdirAll(filepath.Dir(dstPath), 0o755); err != nil {
 		return fmt.Errorf("mkdir firecracker dir: %w", err)
 	}
 
 	if _, err := os.Stat(dstPath); err == nil {
-		fmt.Printf("✓ Firecracker %s exists\n", version)
+		fmt.Printf("✓ Firecracker %s (%s) exists\n", version, arch)
 
 		return nil
 	}
 
-	// Old releases in https://github.com/e2b-dev/fc-versions/releases don't build
-	// x86_64 and aarch64 binaries. They just build the former and the asset's name
-	// is just 'firecracker'
-	// TODO: Drop this work-around once we remove support for Firecracker v1.10
-	assetName := "firecracker-amd64"
-	if strings.HasPrefix(version, "v1.10") {
-		assetName = "firecracker"
+	// Download from GCS bucket with {version}/{arch}/firecracker path
+	fcURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/fc-versions/", version, arch, "firecracker")
+	if err != nil {
+		return fmt.Errorf("invalid Firecracker URL: %w", err)
 	}
-	fcURL := fmt.Sprintf("https://github.com/e2b-dev/fc-versions/releases/download/%s/%s", version, assetName)
-	fmt.Printf("⬇ Downloading Firecracker %s...\n", version)
 
-	return download(ctx, fcURL, dstPath, 0o755)
+	fmt.Printf("⬇ Downloading Firecracker %s (%s)...\n", version, arch)
+
+	if err := download(ctx, fcURL, dstPath, 0o755); err == nil {
+		return nil
+	} else if !errors.Is(err, errNotFound) {
+		return fmt.Errorf("failed to download Firecracker: %w", err)
+	}
+
+	// Legacy URLs are x86_64-only; only fall back for amd64.
+	if arch != "amd64" {
+		return fmt.Errorf("firecracker %s not found for %s (no legacy fallback for non-amd64)", version, arch)
+	}
+
+	legacyURL, err := url.JoinPath("https://storage.googleapis.com/e2b-prod-public-builds/fc-versions/", version, "firecracker")
+	if err != nil {
+		return fmt.Errorf("invalid Firecracker legacy URL: %w", err)
+	}
+
+	fmt.Printf("  %s path not found, trying legacy URL...\n", arch)
+
+	return download(ctx, legacyURL, dstPath, 0o755)
 }
 
-func download(ctx context.Context, url, path string, perm os.FileMode) error {
-	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+var errNotFound = errors.New("not found")
+
+func download(ctx context.Context, rawURL, path string, perm os.FileMode) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
+	if err != nil {
+		return fmt.Errorf("invalid download URL %s: %w", rawURL, err)
+	}
+
 	resp, err := (&http.Client{Timeout: 5 * time.Minute}).Do(req)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode == http.StatusNotFound {
+		return fmt.Errorf("%w: %s", errNotFound, rawURL)
+	}
 	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, url)
+		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, rawURL)
 	}
 
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, perm)
+	// Write to a temporary file and rename atomically to avoid partial files
+	// on network errors or disk-full conditions.
+	tmpPath := path + ".tmp"
+
+	f, err := os.OpenFile(tmpPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, perm)
 	if err != nil {
 		return err
 	}
-	defer f.Close()
 
-	_, err = io.Copy(f, resp.Body)
-	if err == nil {
-		fmt.Printf("✓ Downloaded %s\n", filepath.Base(path))
+	if _, err := io.Copy(f, resp.Body); err != nil {
+		f.Close()
+		os.Remove(tmpPath)
+
+		return err
 	}
 
-	return err
+	if err := f.Close(); err != nil {
+		os.Remove(tmpPath)
+
+		return err
+	}
+
+	if err := os.Rename(tmpPath, path); err != nil {
+		os.Remove(tmpPath)
+
+		return err
+	}
+
+	fmt.Printf("✓ Downloaded %s\n", filepath.Base(path))
+
+	return nil
 }